ConusAI vendor v0.1.0-dev.20261027+9b1131fb

2026-10-27 18:05:17 +00:00
commit 3102273ec7
538 changed files with 80203 additions and 0 deletions
@@ -0,0 +1,147 @@
+# SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+# The mongodb profile's compose.yaml: the same three processes from one image as the default
+# (postgres) profile, with this profile's two links in place of the three Postgres roles
+# (spec §5.1).
+#
+# MongoDB has no row-level security, so there is no owner/runtime/reader split to enforce it
+# with: every process holds the one MONGODB_URL the platform injects for a linked MongoDB, and
+# the tenant wall is the repository predicate, proven by the kit's contract suite
+# (@conusai-kit/data-mongo runs it against MongoDB 8 as a single-node replica set). Jobs are
+# BullMQ on the linked Valkey (REDIS_URL).
+#
+# The linked MongoDB service must be created with `replica_set` set (AT-D15): a standalone server
+# has no multi-document transactions, and the adapter refuses to boot against one. When
+# `replica_set` is set the platform starts mongod with --replSet and rs.initiate(), and the
+# injected MONGODB_URL carries directConnection=true.
+#
+# Ordering is the default profile's mechanism unchanged (decision AT-D14): migrate carries
+# `restart: "no"`, and web and worker wait for it with `condition: service_completed_successfully`.
+services:
+  web:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app/apps/web
+    command: ["node", "node_modules/next/dist/bin/next", "start"]
+    environment:
+      NODE_ENV: production
+      PORT: "3000"
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      CONUSAI_PUBLIC_URL: ${CONUSAI_PUBLIC_URL}
+      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
+      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG:-}
+      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
+      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
+      CONUSAI_DSN: ${CONUSAI_DSN:-}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
+      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
+      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
+      AI_MODEL: ${AI_MODEL:-}
+      LOG_LEVEL: ${LOG_LEVEL:-}
+      MONGODB_URL: ${MONGODB_URL}
+      REDIS_URL: ${REDIS_URL}
+      AUTH_SESSION_SECRET: ${AUTH_SESSION_SECRET}
+      OIDC_ISSUER: ${OIDC_ISSUER:-}
+      OIDC_WEB_CLIENT_ID: ${OIDC_WEB_CLIENT_ID:-}
+      OIDC_WEB_CLIENT_SECRET: ${OIDC_WEB_CLIENT_SECRET:-}
+      OIDC_RESOURCE: ${OIDC_RESOURCE:-}
+      OIDC_INTROSPECTION_CLIENT_ID: ${OIDC_INTROSPECTION_CLIENT_ID:-}
+      OIDC_INTROSPECTION_CLIENT_SECRET: ${OIDC_INTROSPECTION_CLIENT_SECRET:-}
+      OIDC_RESOURCE_STATUS_URL: ${OIDC_RESOURCE_STATUS_URL:-}
+      OIDC_SCOPES: ${OIDC_SCOPES:-}
+      AUTH_PROVIDER_GENERATION: ${AUTH_PROVIDER_GENERATION:-}
+      AUTH_COOKIE_NAME: ${AUTH_COOKIE_NAME:-}
+      AUTH_SESSION_IDLE_SECONDS: ${AUTH_SESSION_IDLE_SECONDS:-}
+      AUTH_SESSION_ABSOLUTE_SECONDS: ${AUTH_SESSION_ABSOLUTE_SECONDS:-}
+      OIDC_AUDIENCE: ${OIDC_AUDIENCE:-}
+    expose: ["3000"]
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    healthcheck:
+      test: ["CMD", "node", "-e", "fetch('http://127.0.0.1:3000/api/ready').then(r=>process.exit(r.ok?0:1),()=>process.exit(1))"]
+      interval: 10s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    init: true
+    stop_grace_period: 20s
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 768M
+
+  worker:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app
+    command: ["node", "apps/worker/dist/main.js"]
+    environment:
+      NODE_ENV: production
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      CONUSAI_ORG_ID: ${CONUSAI_ORG_ID}
+      CONUSAI_ORG_SLUG: ${CONUSAI_ORG_SLUG:-}
+      CONUSAI_RELEASE: ${CONUSAI_RELEASE}
+      CONUSAI_ENVIRONMENT: ${CONUSAI_ENVIRONMENT:-}
+      CONUSAI_DSN: ${CONUSAI_DSN:-}
+      OTEL_EXPORTER_OTLP_ENDPOINT: ${OTEL_EXPORTER_OTLP_ENDPOINT:-}
+      OTEL_EXPORTER_OTLP_PROTOCOL: ${OTEL_EXPORTER_OTLP_PROTOCOL:-}
+      OTEL_EXPORTER_OTLP_HEADERS: ${OTEL_EXPORTER_OTLP_HEADERS:-}
+      OTEL_SERVICE_NAME: ${OTEL_SERVICE_NAME:-}
+      OTEL_SERVICE_VERSION: ${OTEL_SERVICE_VERSION:-}
+      AI_MODEL: ${AI_MODEL:-}
+      LOG_LEVEL: ${LOG_LEVEL:-}
+      MONGODB_URL: ${MONGODB_URL}
+      REDIS_URL: ${REDIS_URL}
+      WORKER_HEARTBEAT_FILE: /tmp/worker-heartbeat
+    depends_on:
+      migrate:
+        condition: service_completed_successfully
+    healthcheck:
+      test: ["CMD", "node", "apps/worker/dist/healthcheck.js"]
+      interval: 15s
+      timeout: 5s
+      retries: 3
+      start_period: 20s
+    init: true
+    stop_grace_period: 30s
+    restart: unless-stopped
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M
+
+  migrate:
+    build:
+      context: .
+      dockerfile: Dockerfile
+      target: runtime
+    working_dir: /app
+    command: ["node", "apps/worker/dist/migrate.js"]
+    environment:
+      NODE_ENV: production
+      CONUSAI_API_URL: ${CONUSAI_API_URL}
+      CONUSAI_API_TOKEN: ${CONUSAI_API_TOKEN}
+      CONUSAI_PROJECT_ID: ${CONUSAI_PROJECT_ID}
+      # One login, not three: there is no RLS to bind, so the owner/runtime/reader split of the
+      # postgres profile has no counterpart here (decision AT-D20 is Postgres-only, DS21).
+      MONGODB_URL: ${MONGODB_URL}
+    restart: "no"
+    init: true
+    deploy:
+      resources:
+        limits:
+          cpus: "1.0"
+          memory: 512M